Researchers at AI security firm Adversa found a way to bypass security filters in AI models by hiding an attack inside AES encryption. The team demonstrated the technique, called Cryptographic Context Injection, against xAI’s Grok model, which decrypted the attack and followed the malicious instructions.
The attack involved encrypting a data-exfiltration payload with AES-256-GCM and providing the necessary decryption information to Grok. When the model decrypted the payload, it generated plaintext instructions that told it to retrieve sensitive user information and send it to an attacker-controlled server.
Grok’s security filters are designed to catch malicious instructions before the model can act on them. However, when the researchers encrypted the payload and provided the decryption information, Grok generated the plaintext instructions inside its code execution environment, bypassing the security filters.
Related: AI disrupts code review and knowledge sharing
The webpage used in the demonstration contained ciphertext, PBKDF2 parameters, AES-256-GCM key material, and instructions for decrypting the payload. When a user asked Grok to summarize the page, the model ran the decryption inside its Python code execution environment and followed the instructions.
Interestingly, Grok refused to perform the same attack when the researchers put the data-exfiltration instructions directly on the webpage. The researchers believe that Grok checks text entering and leaving the model but doesn’t apply the same inspection to plaintext returned by its code execution environment.
Adversa lead researcher Rony Utevsky argues that this is a broader problem that requires checking not just what goes into the model but also what comes out of it. Anything that comes back from tools can introduce its own risk, and Adversa sees Cryptographic Context Injection as part of this problem.
Related: Palo Alto Networks Targets Midmarket SMBs Via Channel Program
They have also tested the technique against Google’s Gemini, which was vulnerable to a variant of the attack.
The Adversa team has attempted the attack 20 times since June with a 40% success rate, and Gemini has since become more resistant to the technique.
However, the researchers avoided reporting their findings to Google because jailbreaks fall outside the scope of its vulnerability disclosure program.
